youngkermit8-coder opened a new issue, #1640: URL: https://github.com/apache/rocketmq-dashboard/issues/1640
## Problem `AclService#createAndUpdatePlainAccessConfig` is the only ACL write path that does not call `OperationAuditService`. Creating or changing a plain-access account therefore leaves no operator, timestamp, resource, or outcome in the Studio audit log, while rule and user CRUD operations are audited consistently. This makes security-sensitive account changes—including admin status, permissions, secrets, and IP whitelist updates—hard to trace. ## Expected After a successful plain-access upsert, record a successful audit event that: - identifies the access key as the affected ACL user; - uses a distinct operation type for the upsert; - records only non-secret metadata; - never includes the secret key or the concrete whitelist value; - does not roll back an already successful ACL write if audit persistence fails, matching the existing ACL audit behavior. ## Suggested test Verify the service emits the expected `OperationAuditService.record` call after repository success and that the audit detail excludes credentials and whitelist contents. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
